﻿using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;

namespace Common {
	public class StringHelper {

		/// <summary>过滤 Sql 语句字符串中的注入脚本
		/// </summary>
		/// <param name="source">传入的字符串</param>
		/// <param name="isTrim">是否去除字符串两边的空格</param>
		/// <returns></returns>
		public static string FilterSql(string source, bool isTrim) {
			if (string.IsNullOrEmpty(source)) {
				return "";
			}
			//去空格
			if (isTrim) source = source.Trim();

			//去除'
			source = source.Replace("'", "");

			///////////////要用正则表达式替换，防止字母大小写得情况////////////////////
			//去除执行存储过程的命令关键字
			source = source.Replace("Exec", "");
			source = source.Replace("Execute", "");

			//去除系统存储过程或扩展存储过程关键字
			source = source.Replace("xp_", "x p_");
			source = source.Replace("sp_", "s p_");
			//防止16进制注入
			source = source.Replace(new string((char)0, 1), "");
			source = source.Replace("0x", "0 x");
			source = source.Replace("<" + "%", "");
			source = source.Replace("%" + ">", "");

			return source;

		}
		public static string FilterSql(string source) {
           return FilterSql(source, true);
        }
		/// <summary>字符串转换为大写,转换失败后返回""
		/// </summary>
		/// <param name="value">被转换的字符串</param>
		/// <returns>转换成大写后的字符串</returns>
		public static string Upper(String value) {
			try {
				return value.ToUpper();
			}
			catch (Exception ex) {
				return "";
			}
		}
	}
}
